CVE Brief Security Intelligence

A path traversal vulnerability in Apache Airflow's Google provider allows attackers to potentially write files to unauthorized locations due to insufficient sanitization of GCS object names.

An untrusted Java deserialization vulnerability exists in the Apache OpenNLP SvmDoccatModel component, potentially allowing arbitrary code execution.

Coolify is vulnerable to OS Command Injection, allowing an authenticated user to execute arbitrary commands on the underlying host system.

Coolify contains an OS command injection vulnerability that allows an authenticated user to execute arbitrary commands on the host server.

Coolify is susceptible to an OS command injection vulnerability, enabling authenticated users to perform unauthorized command execution on the host machine.

Coolify is susceptible to an OS Command Injection vulnerability that allows authenticated attackers to execute arbitrary system commands on the host server.

Coolify contains an OS Command Injection vulnerability allowing authenticated attackers to execute arbitrary commands on the host system via improper input neutralization.

Coolify is vulnerable to OS Command Injection, enabling authenticated attackers to execute arbitrary system commands through insecure input handling.

Coolify is vulnerable to OS Command Injection, allowing authenticated users to execute arbitrary commands on the underlying host system.

Coolify is susceptible to an OS Command Injection vulnerability, permitting authenticated users to execute arbitrary commands on the host server.

Coolify contains a path traversal vulnerability that allows authenticated users to access or manipulate restricted files on the server.

Coolify is susceptible to an OS Command Injection vulnerability, allowing authenticated attackers to execute arbitrary system commands on the host server.

Coolify contains an OS command injection vulnerability that allows authenticated users to execute arbitrary system commands via improper input neutralization.

Coolify is vulnerable to an OS command injection flaw, allowing authenticated attackers to execute arbitrary code on the host operating system.

Coolify is susceptible to OS command injection, allowing authenticated attackers to execute arbitrary system commands via improper neutralization of special elements.

Coolify is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which could allow an unauthorized party to perform actions on behalf of an authenticated user.

Coolify is affected by an authorization bypass vulnerability, allowing authenticated users to access resources they are not permitted to view via user-controlled keys.

The Apache Camel PQC component is susceptible to a Deserialization of Untrusted Data vulnerability, potentially allowing remote code execution if exploited.

The Apache Camel CXF SOAP component is vulnerable to an Improper Input Validation and 'Confused Deputy' issue, allowing unauthenticated attackers to bypass security controls.

An improper privilege management vulnerability in the AllCoach WordPress plugin allows authenticated users with lower privileges to perform unauthorized actions.

The Simple Membership WordPress plugin contains a Cross-Site Scripting (XSS) vulnerability, allowing unauthenticated attackers to execute malicious scripts in the context of a user's browser.

The FileOrganizer WordPress plugin contains an Unrestricted Upload of File with Dangerous Type vulnerability, enabling authenticated users to upload arbitrary files to the server.

Apache Camel is susceptible to an untrusted Java deserialization vulnerability, which could allow an attacker to achieve full system compromise.

A deserialization of untrusted data vulnerability exists in Apache Camel, potentially allowing unauthorized attackers to gain control over the system.

A deserialization of untrusted data vulnerability exists in the Apache Camel Hazelcast component, potentially allowing remote code execution.

The Admin and Site Enhancements (ASE) WordPress plugin is susceptible to an Improper Privilege Management vulnerability, which can lead to unauthorized access or privilege escalation.

The Ultimate Member WordPress plugin is vulnerable to Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing authenticated attackers to execute malicious scripts.

A Deserialization of Untrusted Data vulnerability exists in the Apache Camel JMS component, allowing potential remote code execution or data manipulation.

A vulnerability in the vLLM inference engine allows for potential denial-of-service attacks due to inefficient regular expression complexity.

The Elixir-Mint HPAX library contains an inefficient algorithmic complexity vulnerability allowing unauthenticated denial-of-service via unbounded HPACK integer decoding.

A path traversal vulnerability in the Notifications for Forms & WordPress Actions plugin allows authenticated users to access or manipulate restricted files.

The pgjdbc PostgreSQL JDBC driver is susceptible to an algorithm downgrade vulnerability, failing to secure connections during the negotiation process.

An improper neutralization of special elements in data query logic exists in the Apache Camel Neo4J component, enabling potential query injection.

A flaw in Red Hat Advanced Cluster Security (RHACS) allows an authenticated user to perform uncontrolled resource consumption via the GraphQL API, potentially causing a denial-of-service.

A vulnerability in the vLLM inference engine allows unauthenticated attackers to trigger a denial-of-service via improper input validation of specified quantities.

A missing authorization vulnerability in the embedded webserver of HP 2800 Series Printers permits unauthenticated access to sensitive configuration or status data.

Apache IoTDB is vulnerable to an uncontrolled resource consumption flaw, which can be triggered by unauthenticated attackers to cause a denial-of-service.

An improper input validation vulnerability exists in the Apache Camel NATS component, which may allow for unauthorized data processing.

The Apache Camel Lucene component contains an improper input validation vulnerability that allows for authorization bypass via user-controlled keys.

A Server-Side Request Forgery (SSRF) and information exposure vulnerability exists in the Apache Camel Vertx Websocket component due to improper input validation.

The Apache Camel Iggy component is affected by improper input validation, resulting in SSRF and the exposure of sensitive information to unauthorized actors.

Apache Camel is susceptible to an Improper Input Validation vulnerability, potentially allowing unauthenticated remote attackers to impact system integrity and availability.

A critical improper input validation vulnerability in Apache Camel allows unauthenticated attackers to potentially perform unauthorized operations on the affected system.

Apache Camel suffers from an improper input validation vulnerability that could be exploited by unauthenticated remote attackers.

The Pillow imaging library is vulnerable to memory allocation issues when processing images with excessive size values, potentially leading to denial-of-service.

Pillow is vulnerable to a memory allocation issue where an attacker can trigger excessive memory consumption, leading to a denial-of-service condition.

Pillow is vulnerable to a memory allocation issue where an attacker can trigger excessive memory consumption, leading to a denial-of-service condition.

Pillow is vulnerable to a memory allocation issue where an attacker can trigger excessive memory consumption, leading to a denial-of-service condition.

A pre-authentication vulnerability in the network communication subsystem of BeyondTrust Remote Support and Privileged Remote Access allows for uncontrolled resource consumption.

The throttling event handling mechanism in multiple WSO2 products fails to properly validate user-supplied JSON payloads, leading to potential denial-of-service conditions.

A vulnerability in the web application component of BeyondTrust Remote Support and Privileged Remote Access allows authenticated users to exploit improper neutralization of data query logic.

The metrics-service component in Amazon MCP Gateway & Registry is vulnerable to SQL injection within its retention policy management functionality.

The JSON-RPC API in Leantime contains an authorization bypass that allows authenticated users to retrieve sensitive credential information from other accounts.

Traefik is susceptible to multiple vulnerabilities involving improper case sensitivity handling and authentication bypass, potentially leading to unauthorized data access.

The Gitea Notification API leaks private issue metadata even after access has been revoked, resulting in an information disclosure vulnerability.

FOSSBilling is susceptible to a code injection vulnerability, allowing an authenticated administrator to execute arbitrary code within the application environment.

MicroRealEstate is affected by an authentication bypass vulnerability stemming from insufficient management of token states.

Qualcomm Snapdragon chipsets contain a stack-based buffer overflow vulnerability during the processing of HT40 channel layouts.

FOSSBilling contains multiple authorization and information exposure vulnerabilities allowing authenticated users to bypass security controls and access sensitive data.

FOSSBilling suffers from an insufficient session expiration vulnerability, which may allow attackers to maintain unauthorized access to user sessions.

The Elixir-Mint Mint library is vulnerable to resource exhaustion due to a lack of limits or throttling on resource allocation during network operations.

FOSSBilling is susceptible to an authorization bypass via user-controlled keys, allowing authenticated users to access or modify data they are not authorized to view or manage.

Crawl4AI is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, allowing unauthenticated attackers to probe internal network resources.

FOSSBilling contains an improper privilege management vulnerability, allowing authenticated users to escalate their privileges and perform unauthorized administrative actions.

The SharePoint for ownCloud application is susceptible to Server-Side Request Forgery (SSRF), allowing an authenticated user to perform unauthorized requests from the server.

A Server-Side Request Forgery (SSRF) vulnerability in SUSE Rancher Fleet allows for the forgery of unauthenticated webhook requests.

The Armiya Information Technologies Access Control System (GKS) contains a missing authorization flaw, allowing unauthenticated remote attackers to potentially access restricted system functions.

The DrawIO for ownCloud application is vulnerable to Stored Cross-Site Scripting (XSS), which may allow an authenticated user to execute arbitrary scripts in the context of another user's session.

pnpm is affected by a path traversal vulnerability that may allow for unauthorized file system operations.

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that fails to properly validate state parameters.

ownCloud 10 is susceptible to a relative path traversal vulnerability that could allow unauthorized access to the file system.

A memory corruption vulnerability exists in Qualcomm Snapdragon components due to improper buffer handling during memory allocation.

A race condition in Qualcomm Snapdragon components allows memory corruption due to improper handling of parameters between check and use.

A weak password recovery mechanism in FOSSBilling allows unauthenticated attackers to potentially compromise user accounts.

A path traversal vulnerability in HashiCorp Terraform Enterprise during VCS registry module ingestion allows for unauthorized file reads.

FOSSBilling is susceptible to missing authentication and incorrect authorization vulnerabilities, potentially allowing unauthenticated attackers to manipulate critical system functions.

An untrusted search path vulnerability in B&R Industrial Automation APROL allows local authenticated users to escalate privileges by manipulating the application's search environment.

Idvlabs Ontime contains an authorization bypass vulnerability via a user-controlled key, allowing unauthenticated attackers to access sensitive data.

An authorization bypass vulnerability in Idvlabs Ontime allows unauthenticated attackers to access sensitive data via user-controlled keys.

An improper authentication flaw in Genetec Security Center 5 allows unauthenticated attackers to potentially retrieve live video streams.

A memory management flaw in Imager::File::JPEG allows an attacker to cause a denial-of-service condition through improper memory release.

An improper certificate validation vulnerability in B&R Industrial Automation's APROL allows potential security bypasses.

An integer overflow vulnerability exists in the GIMP PSD parser, which may lead to memory corruption when processing malformed image files.

An off-by-one error in GIMP's PNM file format parser may cause memory corruption when processing malformed files.

A SQL injection vulnerability in the add_event.php file of Code-Projects Hotel and Tourism Reservation 1.0 allows for remote, unauthenticated database manipulation.

An unauthenticated Regular Expression Denial of Service (ReDoS) vulnerability exists in Gitea's CODEOWNERS pattern matching, allowing attackers to cause excessive resource consumption.